bug: iOS: ASWebAuthenticationSession is deallocated by ARC right after start(), causing a spurious cancel (error 1) on every call

[kazis]

Bug Report

Capacitor Version

💊   Capacitor Doctor  💊

Latest Dependencies:

  @capacitor/cli: 8.5.1
  @capacitor/core: 8.5.1
  @capacitor/android: 8.5.1
  @capacitor/ios: 8.5.1

Installed Dependencies:

  @capacitor/cli: 8.5.1
  @capacitor/core: 8.5.1
  @capacitor/android: 8.5.1
  @capacitor/ios: 8.5.1

[success] iOS looking great! 👌
[success] Android looking great! 👌

Plugin Version

App Name: Expresso
App ID: one.expresso.app
App Version: 1.0.0
Web Dir: dist
OS: darwin Darwin Kernel Version 25.6.0

Installed Dependencies:
  @capgo/cli: 8.50.3
  @capgo/capacitor-inappbrowser: 8.16.6
  @capgo/capacitor-native-navigation: 8.3.1
  @capgo/capacitor-navigation-bar: 8.2.7

Latest Dependencies:
  @capgo/cli: 8.50.3
  @capgo/capacitor-inappbrowser: 8.16.6
  @capgo/capacitor-native-navigation: 8.3.1
  @capgo/capacitor-navigation-bar: 8.2.7

✅ All dependencies are up to date

context(s)

ManualModel: false
AutoMode: false
CapgoCloud: false
OnPremise: false

Platform(s)

iOS (real device, iPhone 17 Pro, iOS 26). Not applicable to Android.

Current Behavior

Calling InAppBrowser.openSecureWindow(...) on iOS intermittently completes almost immediately with a rejection carrying ASWebAuthenticationSessionErrorCode.canceledLogin (error 1) or presentationContextInvalid (error 3), even though the user never touched or dismissed anything. This is most reliably reproduced right after a cold app launch, before the native view/window hierarchy has fully settled: session.start() returns true, the presentation window is valid, but the completion handler fires with an error roughly 100ms later — every single time on some launches.

Root cause: in openSecureWindow (InAppBrowserPlugin.swift), the ASWebAuthenticationSession instance is only referenced by a local let inside the closure that constructs it:

DispatchQueue.main.async {
    let session = ASWebAuthenticationSession(url: url, callbackURLScheme: callbackURLScheme) {
        callbackURL, error in
        // ...
    }
    session.prefersEphemeralWebBrowserSession = prefersEphemeral
    session.presentationContextProvider = self
    session.start()
}

session.start() is asynchronous and returns immediately. Nothing on self (the plugin instance) retains session after the enclosing closure returns, so ARC is free to deallocate it right away — sometimes before the sheet is even fully presented to the user.

Expected Behavior

openSecureWindow should only report a cancellation when the user actually dismisses the sheet or the request is genuinely invalid — not as a side effect of the session object being deallocated by ARC while still in use.

Retaining the session for the duration of its use fixes this. Add a class property, set it before start() is called, and clear it in the completion handler:

private var currentAuthSession: ASWebAuthenticationSession?

// ...
DispatchQueue.main.async {
    let session = ASWebAuthenticationSession(url: url, callbackURLScheme: callbackURLScheme) {
        [weak self] callbackURL, error in
        self?.currentAuthSession = nil
        // ... existing handling
    }
    session.prefersEphemeralWebBrowserSession = prefersEphemeral
    session.presentationContextProvider = self
    self.currentAuthSession = session   // must be set before start()
    session.start()
}

We applied exactly this fix locally via a pnpm patch on 8.16.6 and it fully resolved the spurious-cancel behavior on the real device — confirmed the same code path with NSLog instrumentation before and after: without the retain, the completion handler fires with an error ~100ms after start() returns on a cold launch; with it, the sheet presents normally and the completion handler only fires on a real user action or a real redirect. Checked the current main branch source on GitHub — the retain is still absent there as of this writing, so this is not yet fixed upstream.

Code Reproduction

Minimal repro shape (this is the exact call our app makes):

import { InAppBrowser } from '@capgo/capacitor-inappbrowser';

async function login() {
  const { redirectedUri } = await InAppBrowser.openSecureWindow({
    authEndpoint: 'https://your-oidc-provider.example/authorize?...',
    redirectUri: 'yourapp://callback',
  });
}

Call login() as early as possible after a cold app launch (e.g. from an app-level auto-login effect that fires on mount, before any user interaction) on a real iOS device. It is timing-dependent — it does not reproduce on every single launch, but reproduces often enough in practice that it broke our login flow's cold-boot path outright until we patched it.

Other Technical Details

npm --version output: 11.17.0

node --version output: v24.13.0

pod --version output (iOS issues only): 1.17.0

Additional Context

We are happy to open a PR with the fix above (already validated against 8.16.6 via pnpm patch) if that is useful — just let us know.

[edwinalexishernandezgonzalez2-rgb]

/attempt #694

Confirmed on main in openSecureWindow (InAppBrowserPlugin.swift ~2761).

ASWebAuthenticationSession is created as a local let session inside DispatchQueue.main.async. After session.start() the block returns, ARC releases the session, and iOS reports ASWebAuthenticationSessionErrorCode.canceledLogin (error 1). This is the documented Apple requirement: the session must be retained for its lifetime.

SafariViewController is already stored as an instance property (safariViewController). The auth session is not.

Minimal fix — add a property and hold the session until the callback:

private var authSession: ASWebAuthenticationSession?

self.authSession = session
session.prefersEphemeralWebBrowserSession = prefersEphemeral
session.presentationContextProvider = self
session.start()

And in the completion handler, before resolving/rejecting:

self.authSession = nil
self.openSecureWindowCall = nil

I cannot open the PR from this GitHub connection (no fork permission). The change is retain-until-callback only — no API or Android impact.

[edwinalexishernandezgonzalez2-rgb]

Ready-to-apply patch for the ARC dealloc

Root cause confirmed on main (openSecureWindow, ~L2761): ASWebAuthenticationSession is a local let inside DispatchQueue.main.async. start() returns immediately, the closure ends, ARC releases the session, iOS fires canceledLogin (error 1) / presentationContextInvalid (error 3).

Apple requires the session to be retained for its lifetime. SFSafariViewController is already kept as safariViewController. The auth session is not.

I cannot open a PR from this GitHub connection (fork/create-repo is 403 for the integration). Maintainers can apply this as-is.

1. Property (next to openSecureWindowCall)

private var openSecureWindowCall: CAPPluginCall?
private var authSession: ASWebAuthenticationSession?

2. openSecureWindow body — retain before start(), release in the callback

DispatchQueue.main.async {
    let session = ASWebAuthenticationSession(url: url, callbackURLScheme: callbackURLScheme) {
        [weak self] callbackURL, error in
        self?.authSession = nil
        self?.openSecureWindowCall = nil

        if let error = error {
            call.reject(error.localizedDescription)
            return
        }

        guard let callbackURL = callbackURL else {
            call.reject("No callback URL received")
            return
        }

        if !SecureWindowRedirectSupport.matches(callbackURL, redirectUri: redirectUri) {
            call.reject("Redirect URI does not match, expected " + redirectUri + " but got " + callbackURL.absoluteString)
            return
        }

        call.resolve(["redirectedUri": callbackURL.absoluteString])
    }

    session.prefersEphemeralWebBrowserSession = prefersEphemeral
    session.presentationContextProvider = self
    self.authSession = session
    session.start()
}

No API change. Android untouched. Reporter @kazis already validated the retain via pnpm patch on 8.16.6 on a real iPhone 17 Pro.

Fixes #694